class: center, middle, inverse, title-slide .title[ # ISA 419: Data-Driven Security ] .subtitle[ ## 12: Introduction to Machine Learning ] .author[ ### <br>Fadel M. Megahed, PhD <br><br> Professor <br> Farmer School of Business<br> Miami University<br><br> <a href="https://twitter.com/FadelMegahed"><svg viewBox="0 0 512 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253z" /></svg> <span class="citation">@FadelMegahed</span></a> <br> <a href="https://github.com/fmegahed/"><svg viewBox="0 0 496 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6zm-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3zm44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9zM244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8zM97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1zm-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7zm32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1zm-11.4-14.7c-1.6 1-1.6 3.6 0 5.9 1.6 2.3 4.3 3.3 5.6 2.3 1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2z" /></svg> fmegahed</a> <br> <a href="mailto:fmegahed@miamioh.edu"><svg viewBox="0 0 512 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M476 3.2L12.5 270.6c-18.1 10.4-15.8 35.6 2.2 43.2L121 358.4l287.3-253.2c5.5-4.9 13.3 2.6 8.6 8.3L176 407v80.5c0 23.6 28.5 32.9 42.5 15.8L282 426l124.6 52.2c14.2 6 30.4-2.9 33-18.2l72-432C515 7.8 493.3-6.8 476 3.2z" /></svg> fmegahed@miamioh.edu</a><br> <a href="https://calendly.com/fmegahed"><svg viewBox="0 0 384 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M202.021 0C122.202 0 70.503 32.703 29.914 91.026c-7.363 10.58-5.093 25.086 5.178 32.874l43.138 32.709c10.373 7.865 25.132 6.026 33.253-4.148 25.049-31.381 43.63-49.449 82.757-49.449 30.764 0 68.816 19.799 68.816 49.631 0 22.552-18.617 34.134-48.993 51.164-35.423 19.86-82.299 44.576-82.299 106.405V320c0 13.255 10.745 24 24 24h72.471c13.255 0 24-10.745 24-24v-5.773c0-42.86 125.268-44.645 125.268-160.627C377.504 66.256 286.902 0 202.021 0zM192 373.459c-38.196 0-69.271 31.075-69.271 69.271 0 38.195 31.075 69.27 69.271 69.27s69.271-31.075 69.271-69.271-31.075-69.27-69.271-69.27z" /></svg> Automated Scheduler for Office Hours</a><br><br> ] .date[ ### Spring 2025 ] --- ## Quick Refresher of Last Class ✅ Utilize standalone data viz packages to construct and tailor your graphs. ✅ Examine the use of network and/or spatial plots in the context of network data. --- ## Learning Objectives for Today's Class - Explain the difference between supervised and unsupervised learning. - Understand the importance of different preprocessing steps and when they should be used in ML. - Explain typical error measures used for supervised and unsupervised learning tasks. --- class: inverse, center, middle # What is Machine Learning? --- ## Definition - [Mitchell 2006](http://ra.adm.cs.cmu.edu/anon/usr0/ftp/anon/ml/CMU-ML-06-108.pdf) has elegantly defined the scientific field of machine learning to be centered around answering the following question: > How can we build computer systems that automatically improve with experience, and what are the fundamental laws that govern all learning processes? In his view, machine learning is the study of algorithms that: - Improve their performance `\(P\)` - at some task `\(T\)` - with experience `\(E\)`. --- ## A Paradigm Shift in Programming <img src="data:image/png;base64,#../../figures/mltp.png" width="75%" style="display: block; margin: auto;" /> .footnote[ <html> <hr> </html> **Image Source:** [Yuxi Lui (2019). Python Machine Learning by Example. Packt Publishers](https://subscription.packtpub.com/book/data/9781789616729/1). ] --- ## Examples of a Task, Performance, and Experience .center[**Improve on task `\(T\)`, with respect to performance metric `\(P\)`, based on experience `\(E\)`.**] .pull-left[ - T: Playing checkers - P: Winning percentage against an arbitrary opponent - E: Playing practice games against itself ] .pull-right[ <img src="data:image/png;base64,#../../figures/Pool_checkers_(Jamaica).jpg" width="50%" style="display: block; margin: auto;" /> ] Note: This idea in [Samuel (1959)](https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5392560&tag=1) led to the popularization of machine learning. .footnote[ <html> <hr> </html> **Image Source:** [Wikipedia](https://en.wikipedia.org/wiki/Checkers) ] --- ## Examples of a Task, Performance, and Experience .center[**Improve on task `\(T\)`, with respect to performance metric `\(P\)`, based on experience `\(E\)`.**] .pull-left[ - T: Recognizing spoken words - P: Accuracy of recognizing words - E: Listening to a large number of words and their pronunciations ] .pull-right[ <html> <center> <audio controls autoplay muted> <source src="data:image/png;base64,#micro-machines.wav" type="audio/wav"/> </audio> </center> </html> > .font30[This is the Micro Machine Man presenting the most midget miniature motorcade of Micro Machines. Each one has dramatic details, terrific trim, precision paint jobs, plus incredible Micro Machine Pocket Play Sets. There’s a police station, fire station, restaurant, service station, and more. Perfect pocket portables to take any place. And there are many miniature play sets to play with, and each one comes with its own special edition Micro Machine vehicle and fun, fantastic features that miraculously move. Raise the boatlift at the airport marina. Man the gun turret at the army base. Clean your car at the car wash. Raise the toll bridge. And these play sets fit together to form a Micro Machine world. Micro Machine Pocket Play Sets, so tremendously tiny, so perfectly precise, so dazzlingly detailed, you’ll want to pocket them all. Micro Machines are Micro Machine Pocket Play Sets sold separately from Galoob. The smaller they are, the better they are.] ] .footnote[ <html> <hr> </html> **Audio Source:** [OpenAI](https://openai.com/research/whisper) ] --- ## Examples of a Task, Performance, and Experience .center[**Improve on task `\(T\)`, with respect to performance metric `\(P\)`, based on experience `\(E\)`.**] .pull-left[ - T: Classifying emails as spam or not spam - P: Accuracy of classifying emails - E: Reading a large number of emails and identifying which ones are spam ] .pull-right[ <img src="https://miro.medium.com/v2/resize:fit:640/format:webp/1*9vX9GriIxB3yRXYtoEiy8w.jpeg" width="50%" style="display: block; margin: auto;" /> ] .footnote[ <html> <hr> </html> **Image Source:** [Sarah Mestiri (2017). Applied Text-Classification on Email Spam Filtering - Part 1. Medium.](https://towardsdatascience.com/applied-text-classification-on-email-spam-filtering-part-1-1861e1a83246). ] --- ## History of Machine Learning <img src="data:image/png;base64,#12_intro_to_ml_files/figure-html/history_ml-1.png" width="960" style="display: block; margin: auto;" /><img src="data:image/png;base64,#12_intro_to_ml_files/figure-html/history_ml-2.png" width="672" style="display: block; margin: auto;" /> <img src="data:image/png;base64,#../../figures/ml_history_timeline_figure.png" width="100%" style="display: block; margin: auto;" /> .footnote[ <html> <hr> </html> **Created By:** Fadel Megahed for ISA 419. **Data Source:** Maryna Klokova (2023). [Evolution of Artificial Intelligence and Machine Learning: A Journey Through Key Milestones](https://medium.com/@marizombie/evolution-of-artificial-intelligence-and-machine-learning-a-visual-journey-through-key-milestones-3b2f63bb2ed7) ] --- ## Types of Machine Learning {width=80%} .footnote[ <html> <hr> </html> **Image Source:** [Scikit-Learn](https://scikit-learn.org/stable/tutorial/machine_learning_map/index.html) ] --- class: inverse, center, middle # Explain the Difference Between Unsupervised and Supervised Learning. --- ## Unsupervised Vs. Supervised Learning | **Aspect** | **Unsupervised Learning** | **Supervised Learning** | |----------------------------------------|---------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------| | **Labels** | Labels are **NOT** known | Labels are known | | **Learning Objective** | The algorithm tries to **learn the underlying structure** of the data | The algorithm tries to **learn the mapping** from input to output | | **Examples** | **Clustering**, **Dimensionality Reduction** | **Regression**, **Classification** | | **Evaluation** | Cannot be evaluated easily | Can be evaluated using **error measures** | <img src="data:image/png;base64,#12_intro_to_ml_files/figure-html/unsupervised_and_supervised-1.png" width="1152" style="display: block; margin: auto;" /> <img src="data:image/png;base64,#../../figures/unsupervised_supervised.png" width="60%" style="display: block; margin: auto;" /> --- ## Unsupervised Learning - We retroactively try to understand the structure of the data. - We do not have any labels to guide us. - So we try to find patterns in the data (and then, we try to make sense of these patterns). - Once we make sense of these patterns, we can use them to guide our decision-making process. - **Cybersecurity** applications include: + **Anomaly Detection**, where we try to find patterns that are different from the norm. + **Clustering**, where we try to group similar entities together (e.g., similar network traffic). + **Dimensionality Reduction**, where we try to reduce the number of features in our data so that we can better understand/visualize/model it. --- ## Supervised Learning - We have labels to guide us. - We build a model that allows us to see: + How the input data is related to the output data. + How we can use this relationship to make predictions. - **Cybersecurity** applications include: + Classification of network traffic as benign or malicious. + Regression to predict the number of attacks on a network. + Time series forecasting to predict future network traffic (technically not a ML problem, but it can be modeled sometimes using ML-type models). --- ## Class Activity: Build a Fun Model with No Code <div class="countdown" id="timer_1cdd30e2" data-update-every="1" tabindex="0" style="top:0;right:0;font-size:2em;"> <div class="countdown-controls"><button class="countdown-bump-down">−</button><button class="countdown-bump-up">+</button></div> <code class="countdown-time"><span class="countdown-digits minutes">05</span><span class="countdown-digits colon">:</span><span class="countdown-digits seconds">00</span></code> </div> Go to <https://teachablemachine.withgoogle.com/v1/> and build a simple model to classify images by following the instructions on the page. <iframe src="https://teachablemachine.withgoogle.com/v1/" width="100%" height="400px" data-external="1"></iframe> --- class: inverse, center, middle # Preprocessing Steps in Machine Learning --- ## Preprocessing Steps in Machine Learning - There are several preprocessing steps that are typically used in machine learning. - These steps are used to prepare the data for the model. - These include: | **Step** | **Description** | |------------------------|-----------------| | **Z-Transformation ** | Scaling the continuous data so that they have a mean of 0 and a standard deviation of 1. | | **Data Scaling**| Scaling continuous variables so that they have a min of 0 and a max of 1. | | **Data Encoding**| Encoding categorical data using label or one-hot encoding. | | **Data Imputation**| Filling in missing data (apply with caution, only after understanding the type of missingness). | | **Data Reduction** | Reducing the number of features in the data. | --- ## Preprocessing Steps in Machine Learning - **Z-Transformation**: + This is done to ensure that the data have a mean of 0 and a standard deviation of 1. + This is important for algorithms that are sensitive to the scale of the data (e.g., K-Means clustering). + It is also important for algorithms that use gradient descent (e.g., neural networks). - **Data Scaling**: + This is done to ensure that the data have a minimum of 0 and a maximum of 1. + This has a similar use case to Z-Transformation. - **Data Encoding**: + This is done to convert categorical data into a format that can be used by the model. + This is important because most models (e.g., neural networks) cannot handle categorical data. --- ## Preprocessing Steps in Machine Learning - **Data Imputation**: + This is done to fill in missing data. + This is important because most models cannot handle missing data. + However, this should be done with caution, as it can introduce bias into the model. - **Data Reduction**: + This is done to reduce the number of features in the data. + This is important because it can help to reduce the complexity of the model, which can help to reduce overfitting. --- class: inverse, center, middle # Error Measures in Machine Learning --- ## Supervised Learning Model Evaluation: Clustering <img src="data:image/png;base64,#12_intro_to_ml_files/figure-html/silhouette_score-1.png" width="1152" style="display: block; margin: auto;" /><img src="data:image/png;base64,#12_intro_to_ml_files/figure-html/silhouette_score-2.png" width="672" style="display: block; margin: auto;" /> <img src="data:image/png;base64,#../../figures/silhouette_score_figure.png" width="1382" style="display: block; margin: auto;" /> .footnote[ <html> <hr> </html> **Created By:** Fadel M. Megahed for ISA 419. ] --- ## Supervised Learning Model Evaluation: Clustering - **Silhouette Score**: + This is a measure of how similar an object is to its own cluster (cohesion) compared to other clusters (separation). + The silhouette score ranges from -1 to 1. + A high silhouette score indicates that the object is well matched to its own cluster and poorly matched to neighboring clusters. --- ## Supervised Learning Model Evaluation: Classification <img src="data:image/png;base64,#12_intro_to_ml_files/figure-html/confusion_matrix-1.png" width="480" style="display: block; margin: auto;" /><img src="data:image/png;base64,#12_intro_to_ml_files/figure-html/confusion_matrix-2.png" width="672" style="display: block; margin: auto;" /> <img src="data:image/png;base64,#../../figures/confusion_matrix_figure.png" width="60%" style="display: block; margin: auto;" /> --- ## Supervised Learning Model Evaluation: Classification - **Accuracy**: + This is the proportion of correctly classified instances (i.e., `\(\frac{TP + TN}{TP + TN + FP + FN}\)`) + It is **not** a good measure when the classes are imbalanced or when the cost of misclassification is high. - **Precision**: + This is the proportion of true positive predictions out of all positive predictions (i.e., `\(\frac{TP}{TP + FP}\)`). + It is a good measure when the cost of false positives is high. + It is not a good measure when the cost of false negatives is high. --- ## Supervised Learning Model Evaluation: Classification - **Recall**: + This is the proportion of true positive predictions out of all actual positive instances (i.e., `\(\frac{TP}{TP + FN}\)`). + It is a good measure when the cost of false negatives is high. + It is not a good measure when the cost of false positives is high. - **F1-Score**: + This is the harmonic mean of precision and recall (i.e., `\(2 \times \frac{precision \times recall}{precision + recall}\)`). + It is a good measure when the cost of false positives and false negatives is high. + It is a good measure when the classes are imbalanced. --- ## Supervised Learning Model Evaluation: Classification - **ROC Curve**: + This is a plot of the true positive rate against the false positive rate (i.e., `\(\frac{TP}{TP + FN}\)` vs. `\(\frac{FP}{FP + TN}\)`). - **AUROC**: + This is the area under the ROC curve. + It is a good measure when the cost of false positives and false negatives is high. + It is a good measure when the classes are imbalanced. --- ## Supervised Learning Model Evaluation: Regression - **Mean Error (ME)**: + This is the average of the differences between predictions and actual values. + It is a measure of bias. - **Mean Absolute Error (MAE)**: + This is the average of the absolute differences between predictions and actual values. + It is a good measure when the cost of large errors is high. + It is not a good measure when the cost of small errors is high. - **Mean Squared Error (MSE)**: + This is the average of the squared differences between predictions and actual values. + It is a good measure when the cost of large errors is high. + It is not a good measure when the cost of small errors is high. --- class: inverse, center, middle # Recap --- ## Summary of Main Points By now, you should be able to do the following: - Explain the difference between supervised and unsupervised learning. - Understand the importance of different preprocessing steps and when they should be used in ML. - Explain typical error measures used for supervised and unsupervised learning tasks. --- ## 📝 Review and Clarification 📝 1. **Class Notes**: Take some time to revisit your class notes for key insights and concepts. 2. **Zoom Recording**: The recording of today's class will be made available on Canvas approximately 3-4 hours after the end of class. 3. **Questions**: Please don't hesitate to ask for clarification on any topics discussed in class. It's crucial not to let questions accumulate.